Give Every Workload Its Own Key, Limited to One Folder
Several workloads can now share one bucket, each with its own key that reaches only its own folder.
What's changed
- In Security, S3 credentials, choose By bucket policy when you create an access key: the key has no access of its own and reaches only what a bucket policy gives it
- In a bucket's Access tab, click Edit policy and use Give a key access to a folder: pick the key, the folder or the whole bucket, and a level (read only, read and write, or full access), then save
- Saving a policy asks you to confirm it's you, and we email you whenever what you saved changed the policy
- Keys created for chosen buckets or by bucket policy have an ARN of their own, shown when you create the key and in its details, so a policy can name one key and no other
- The same works over the API (scope none for a key, and endpoints to read and replace a bucket's policy or add a folder grant) and in danube CLI 1.7 with danube storage keys create --scope none and danube storage policy get, set and grant
- A key limited to a folder cannot list the top level of the bucket, so point your S3 client at the folder; about 30 folder grants fit in one bucket policy; a key that reaches a bucket only through its policy cannot be used for SFTP on it
- Folder grants work on buckets hosted on the current high-durability storage endpoint, the buckets that have the policy editor